The present invention relates to the field of communication networks, and in particular to the systems and methods for authenticating users and devices for access to communication networks. Communications networks allow computers and other electronic devices to exchange data. Wireless networks, which exchange data without wires, typically using radio waves, are popular with users due to the ability to send and receive data almost anywhere within the physical coverage area of the network. This allows users to access communication networks, including local area networks, organization or company intranets, virtual private networks, and wide area networks, such as the Internet, anywhere within the physical coverage area of the wireless networks.
Wireless networks with large physical coverage areas, such as networks covering university campuses or entire cities, offer users ubiquitous access to their data and the Internet. However, typical wireless access points have a ranges of around 100 feet. As a result, large wireless networks require tens, hundreds, or thousands of wireless access points to provide network coverage over a large physical area.
Configuring, managing, and operating a large number of wireless access points requires complicated network configurations. One complication with managing wireless access points is managing network security. Network security typically includes authentication to prevent unauthorized users or devices from accessing the network and data encryption to prevent eavesdropping on communications of authorized users or devices.
There are many wired and wireless networking standards, including the 802.11 set of IEEE standards, that govern wireless networking communications and security methods. In general, the most secure types of wireless networking security, such as the 802.1X standard, often rely on authentication servers and cryptographic certificates to authenticate users and devices and exchange encryption keys to establish secure network connections. However, configuring and maintaining authentication servers and certificates is complicated, error-prone, and expensive. Additionally, users often find it difficult to install the required certificates and configure their devices to use these authentication schemes. This makes it difficult to deploy this type of network security, especially in situations where users and devices are frequently added and removed, such as hotels, conference centers, and other locations that wish to provide wireless networking to visitors.
Another network security approach relies on a preshared key (PSK) to authenticate users and establish secure communications. In these approaches, users are provided with a password or other login information in advance of connecting with the network. This approach is relatively easy for users and network administrators to implement. Authentication servers and certificates are not required. Users can typically configure their devices to connect with the network by inputting the provided password or other login information.
However, preshared key approaches are much less secure than other authentication techniques. Typically, a single preshared key is used by every user and device connecting with the network. This allows any user or device to eavesdrop on the communications of any other device connected via the network. Additionally, anyone with knowledge of the preshared key can access the network. This can be a disadvantage when an employee leaves a company, but can still access the company network using the preshared key. To prevent this, network administrators can change the preshared key. However, this requires all of the legitimate network users and devices to update their configurations, which can be very disruptive.